Windows 10: Improving security for Windows 10 devices receiving updates via WSUS

Brink · Sep 8, 2020

With the September 2020 cumulative update for Windows 10, we introduced changes that help improve the security of devices that scan Windows Server Update Services (WSUS) for their updates. This post will describe those changes and offer basic recommendations to help you better secure the devices in you organization.

Secure by default

First, beginning with the September 2020 cumulative update, HTTP-based intranet servers will be secure by default. To ensure that your devices remain inherently secure, we are no longer allowing HTTP-based intranet servers to leverage user proxy by default to detect updates. If you have a WSUS environment not secured with TLS protocol/HTTPS and a device requires a proxy in order to successfully connect to intranet WSUS Serversâand that proxy is only configured for users (not devices)âthen your software update scans against WSUS will start to fail after your device successfully takes the September 2020 cumulative update.

Recommendations for greater security

To help ensure the security of your WSUS infrastructure, Microsoft recommends using the TLS/SSL protocol between your devices and your WSUS servers. The Microsoft Update system (including WSUS) relies on two types of content: update payloads and update metadata. Update payloads are the data files that contain the software update components that make up the update. Update metadata is all the information that the Microsoft Update system needs to know about the updates, including which updates are available, which devices each update can be applied to, and where to retrieve the payloads for each update. Both types of content are crucial and they both need to be protected to help keep your computers secure and up to date.

Update payloads are protected against modification by multiple means, including digital signature checks and cryptographic hash verifications. HTTPS provides a proper chain of custody which the client uses to prove the data is trusted.

When a device receives updates directly from Microsoft Update, that device receives update metadata directly from Microsoft servers. This metadata is always transmitted via HTTPS to prevent tampering. When you use WSUS or Configuration Manager to manage your organization's updates, the update metadata travels from Microsoft servers to your devices via a chain of connections. Each one of these connections needs to be protected against malicious attacks.

Your WSUS server connects with Windows Update servers and receives update metadata. This connection always uses HTTPS, and the HTTPS security features guard the metadata against tampering. If you have multiple WSUS servers arranged in a hierarchy, the downstream servers receive metadata from the upstream servers. Here, you have a choice: you can use HTTP or HTTPS for these metadata connections. Using HTTP; however, can be very dangerous as it breaks the chain of trust and can leave you vulnerable to attack. Using HTTPS enables the WSUS server to prove that it trusts the metadata it receives from the upstream WSUS server.

In order to maintain the chain of trust and prevent attacks on your client computers, you must ensure that all metadata connections within your organizations â the connections between upstream and downstream WSUS servers, and the connections between the WSUS servers and your client computers â are defended against attacks. To do so, we highly recommend that you configure your WSUS network to protect these connections using HTTPS. To learn more, see Michael Curetonâs post Security best practices for Windows Server Update Services (WSUS).

Even with HTTPS configured, it is still very important that you utilize a system-based proxy rather than a user-based proxy if a proxy is needed. When using a user-based proxy, a user, even one without elevated privileges, could intercept and manipulate the data being exchanged between the update client and the update server.

Recommendations for those who absolutely need user proxy

If you do need to leverage a user-based proxy to detect updates while using an HTTP-based intranet server, despite the vulnerabilities it presents, make sure to configure the proxy behavior to "Allow user proxy to be used as a fallback if detection using system proxy fails."

Group Policy path: Windows Components>Windows Update>Specify intranet Microsoft update service location

Configuration Service Provider path: Update/ SetProxyBehaviorForUpdateDetection

Next steps

If you are an IT administrator who currently manages an HTTP-configured WSUS environment and relies on user-based proxy for client scans, please consider taking one of the following actions as soon as possible. If none of these actions are taken your devices will stop successfully scanning for software updates after the September 2020 security update.

Options to ensure that devices in your environment can continue to successfully scan for updates:

Secure your WSUS environment with TLS/SSL protocol (configure servers with HTTPS).

Set up system-based proxy for detecting updates if needed.

Click to expand...

Source: https://techcommunity.microsoft.com/...s/ba-p/1645547

:)

AsRock · Sep 8, 2020

Windows 10 Update

Well just noticed a pretty large one pop up coming in at 914MB, seems it makes some pretty serous updates.

KB3172985
https://support.microsoft.com/en-us/kb/3172985

This security update includes improvements and fixes in the functionality of Windows 10 Version 1511 and Windows Server 2016 Technical Preview 4. It also resolves the following vulnerabilities in Windows:

3175677 MS16-094: Security update for secure boot: July 12, 2016

3174060 MS16-093: Security update for Adobe Flash Player: July 12, 2016

3171910 MS16-092: Security update for Windows Kernel: July 12, 2016

3170048 MS16-091: Security update for .Net Framework: July 12, 2016

3171481 MS16-090: Security update for Kernel Mode Drivers: July 12, 2016

3170050 MS16-089: Security update for Windows secure kernel mode: July 12, 2016

3170005 MS16-087: Security update for the Microsoft Print Spooler: July 12, 2016

3169999 MS16-085: Cumulative security update for Microsoft Edge: July 12, 2016

3169991 MS16-084: Cumulative security update for Internet Explorer: July 12, 2016

qubit · Sep 8, 2020

The WSUS support thread

This thread is for all things WSUS (Windows Server Update Services). Discussion, installation questions, problems all go here.

What is WSUS? It's basically a big file cache for all your Windows/Microsoft updates, so all your updates are only ever downloaded over the internet once. Instead of getting your updates directly from Microsoft whenever you reinstall your operating system, you point Windows to your local WSUS server instead. This makes downloading the multi-gigabytes of updates way faster using your internal network and also saves your internet bandwidth, which is often metered and limited.

Note that it requires Windows Server to run. I recommend running the latest Server 2008 R2 for performance, stability and security, if you can. This is a 64-bit only OS. And yes, the server can update from it's own WSUS server too. *Cool

I've got links to a few resources below and I'll be adding more goodness to this post and the next one, as people make useful contributions to this thread.

Some WSUS resources to get you started:

The manual: http://technet.microsoft.com/en-us/library/dd939796(WS.10).aspx

WSUS home: http://technet.microsoft.com/en-us/wsus/default.aspx

WSUS forum: Technet forums - WSUS

WSUS wiki: www.wsuswiki.com

POINTING WINDOWS TO THE WSUS SERVER

Note that this procedure is all you have to do on Vista and 7. XP requires a little extra and the whole update process isn't as transparent or efficient.

- Click the Orb at the bottom left of the desktop aka 'Start' button
- In the search field enter GPEDIT.MSC
- In the Local Group Policy Editor (LGPE) console that appears, navigate to: Computer configuration > Administrative Templates > Windows Components > Windows Update
- Double click the Specify Intranet Microsoft update service location Group Policy setting. Note that Not Configured is showing in the State column

- The dialog box opens. Note that the Not Configured radio button is selected

- Enter the server details, by clicking the Enabled radio button and entering the same details in both Options fields. The server's name is the standard Windows name. My server is called afterburner *Smile

- Click OK. The main LGPE window now looks like below. Note that Enabled is now showing in the State column.

- Close the LGPE window

- Open the Windows Update window. It should now show You receive updates: Managed by your system administrator

Now, whenever you check for updates, Windows will access your WSUS server instead of looking over the internet to Microsoft's servers.
If you want to change it back at an time, simply change the Group Policy setting back to Not Configured.

Brink · Sep 8, 2020

KB4524244 Security update for Windows 10 - February 11

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

Security update for Windows 10, version 1607, 1703, 1709, 1803, 1809, 1903, and 1909: February 11, 2020

Important
This standalone security update has been removed due to an issue affecting a sub-set of devices. It will not be re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note Removal of this standalone security update does not affect successful installation or any changes within any other February 11, 2020 security updates, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update.

Summary

This security update makes quality improvements to the supported Windows 10 versions listed in the "Applies to" section. Key changes include the following:

Addresses an issue in which a third-party Unified Extensible Firmware Interface (UEFI) boot manager might expose UEFI-enabled computers to a security vulnerability.

To learn more about this security update, see Microsoft Common Vulnerabilities and Exposures.

Known Issues

[table][tr][td]Symptom[/td] [td]Workaround[/td] [/tr] [tr][td]Using the “Reset this PC” feature, also called “Push Button Reset” or PBR, might fail. You might restart into recovery with “Choose an option” at the top of the screen with various options or you might restart to desktop and receive the error “There was a problem resetting your PC”.[/td] [td]This standalone security update has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update. If you have installed this update and are experiencing this issue, the following steps should allow you to reset your device:

Select the start button or Windows Desktop Search and type update history and select View your Update history.

On the Settings/View update history dialog window, Select Uninstall Updates.

On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.

Restart your device.

Upon restart use the “Reset this PC” feature and you should not encounter this issue.

We are working on an improved version of this update in coordination with our partners and will release it in a future update.[/td] [/tr] [tr][td]You might encounter issues trying to install or after installing KB4524244.[/td] [td]To help a sub-set of affected devices, this standalone security update has been removed and will not re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note This does not affect any other update, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update. If this update is installed and you are experiencing issues, you can uninstall this update.

Select the start button or Windows Desktop Search and type update history and select View your Update history.

On the Settings/View update history dialog window, Select Uninstall Updates.

On the Installed Updates dialog window, find and select KB4524244 and select the Uninstall button.

Restart your device.

We are working on an improved version of this update in coordination with our partners and will release it in a future update.[/td] [/tr] [/table]

How to get this update

Important This standalone security update has been removed due to an issue affecting a sub-set of devices. It will not be re-offered from Windows Update, Windows Server Update Services (WSUS) or Microsoft Update Catalog. Note Removal of this standalone security update does not affect successful installation or any changes within any other February 11, 2020 security updates, including Latest Cumulative Update (LCU), Monthly Rollup or Security Only update.

Prerequisites

There are no prerequisites to apply this update.

Restart information

Your device does not have to restart when you apply this update. If you have Windows Defender Credential Guard (Virtual Secure Mode) enabled, your device will restart two times.

Update replacement information

This update does not replace any previously released update.
Click to expand...

Source: https://support.microsoft.com/en-us/...bruary-11-2020

Download

Uninstall Windows Update in Windows 10

Windows 10: Improving security for Windows 10 devices receiving updates via WSUS

Improving security for Windows 10 devices receiving updates via WSUS

Improving security for Windows 10 devices receiving updates via WSUS

Improving security for Windows 10 devices receiving updates via WSUS

Improving security for Windows 10 devices receiving updates via WSUS - Similar Threads - Improving security devices

WSUS Update for window 10 Failed

WSUS Update for window 10 Failed

WSUS Update for window 10 Failed

Windows 11 2022 Update: security improvements

windows 10 update issues with wsus

Updates Windows 10 from 1909 to 2004 via wsus

Updating Windows 10 via WSUS without Microsost Edge installed -- error

Microsoft Edge Dev for Windows 10 receives a update with improvements

Bypass WSUS for Windows 10 Updates?